When people hear the term insider threat, they typically picture an aggrieved employee stealing confidential information or sabotaging systems. While these incidents happen, they represent a fraction of the problem. Insider risks may also occur when legitimate employees possess excessive access privileges, retain access after changing roles or leaving an organisation, use insecure workarounds, make mistakes or fall for social engineering attacks.
According to Ponemon Institute’s 2026 Cost of Insider Risks: Global study, 53% of insider security risks were attributed to either careless or negligent employees and only 27% of insider risks were attributed to malicious insiders. This demonstrates that insider risks are not limited to deliberate misconduct. Everyday behaviours, including failing to follow security procedures, mishandling sensitive information and using unapproved software can also expose organisations to significant security risks.
For businesses, particularly those handling sensitive client and financial information, understanding the source of these risks is pivotal to preventing them.
What is insider risk?
Insider risks are potential security threats from trusted individuals who have authorised access to company resources, information, systems, data, applications, and whose actions or inactions could compromise the confidentiality, availability and integrity of those assets. Trusted individuals may include employees, third-party suppliers, contractors, temporary staff, business partners, and former staff whose access has not been revoked.
Unlike external threats, internal threats can be difficult to detect. Trusted individuals already have access to an organisation’s resources and typically understand existing security protocols. Their activities may appear legitimate, making traditional perimeter security controls, such as firewalls less effective.
Insider risks generally arise through four types of behaviour:
Human error: An employee unintentionally compromises systems or information through an avoidable mistake such as sending documents to the wrong recipient or accidentally exposing files.
Malicious activity: A trusted individual deliberately abuses their access privileges to commit fraud, steal information, cause harm to an organisation, or disrupt operations. Motivations may include personal grievances, financial gain or other interests.
Negligence: An employee engages in risky behaviour or disregards established security procedures, such as sharing confidential information or using unauthorised applications.
Collusion: An insider colludes with another individual, whether outside or inside the organisation to facilitate unauthorised access, information theft, fraud, or other harmful activities.
While these behaviours differ in intent, they can produce similar consequences, including operational disruption, regulatory exposure, data breaches and financial loss.
Why the Distinction Matters
One of the most dangerous assumptions about insider threats is that they always begin with bad employees. While deliberate misconduct remains a concern, many incidents involve ordinary employees carrying out legitimate responsibilities in environments where permissions, processes or security controls are inadequate. The distinction matters because different circumstances require different responses.
Consider an employee who deliberately downloads a confidential client database before resigning. In this scenario, investigating unusual activity, reviewing access logs and enforcing appropriate permissions are important controls.
Now consider an analyst who unintentionally shares a confidential document through an unrestricted link.
In this case, the relevant questions are different. Why was unrestricted external sharing permitted? Did the analyst need access to the entire folder? Was the document appropriately classified? Could Data Loss Prevention (DLP) controls have prevented the disclosure?
The first scenario involves deliberate misconduct. The second exposes potential weaknesses in how access, information sharing and security policies are managed. Both may result in serious incidents, but preventing them requires more than monitoring employee behaviour.
Insider risk is an access problem, a people problem and a process problem. Effective security must address all three.
Where Insider Risk Comes From
1. Excessive and Accumulated Access
One of the most common insider risks occurs when employees have access to more information and systems than their responsibilities require. Consider an employee who joins the finance department and receives access to several SharePoint libraries. They subsequently move into operations but retain their previous permissions. As they take on additional projects, more access is granted without reviewing what they already hold.
Over time, the employee accumulates permissions that are no longer relevant to their responsibilities.
This does not make the employee malicious. However, it increases the amount of information that could be exposed through a mistake, compromised account or deliberate misuse.
For smaller hedge funds and asset managers, where employees may perform several functions, maintaining appropriate access permissions can be particularly challenging.
Reducing the risk: Organisations should implement role-based access controls, apply the principle of least privilege and conduct periodic access reviews. Permissions should reflect current responsibilities rather than accumulate throughout an employee’s time with the organisation.
2. Weak Joiner, Mover and Leaver Processes
Employee onboarding, role changes and departures are important points in the access management lifecycle. When an employee changes roles, new permissions may be added without removing existing access. When an employee leaves, accounts may remain active across email, cloud platforms, virtual desktops, VPNs and third-party applications.
These weaknesses extend beyond permanent employees. Consultants, outsourced IT providers, fund administrators and other suppliers may also have access to sensitive systems. Without appropriate oversight, contractor accounts can remain active long after an engagement has ended.
Reducing the risk: A documented joiner, mover and leaver process should cover employees, contractors and third-party suppliers. Access should be reviewed whenever responsibilities change and revoked promptly when it is no longer required.
3. Excessive Privileged Access
Not all user accounts present the same level of risk. An administrator who can modify security policies, create accounts or change permissions presents a different level of exposure from a standard employee. Similarly, individuals with access to investor information, portfolio data, deal documentation, compliance records or executive mailboxes may be able to access highly sensitive information. The concern is not simply who holds administrative privileges, but whether those privileges are necessary, appropriately restricted and monitored.
Reducing the risk: Privileged access should be limited to authorised users, separated from everyday accounts where practical, regularly reviewed and supported by appropriate activity logging and monitoring.
4. Everyday Mistakes and the Use of Generative AI
Not every security incident involves an attacker or deliberate misconduct. Employees may attach the wrong investor report to an email, select an incorrect recipient, create unrestricted file-sharing links or transfer sensitive information to personal devices. These everyday mistakes can lead to significant data exposure.
Generative AI introduces another dimension to this risk. An employee might paste confidential investment research, client information or a draft financial report into an unapproved public AI tool to summarise, analyse or improve the content. The intention may simply be to complete a task more efficiently. However, depending on the service and its configuration, the employee may be disclosing sensitive information to an unauthorised third party.
The growing use of cloud applications, collaboration platforms and AI tools means sensitive information can leave an organisation through several channels, not just email.
Reducing the risk: Organisations should identify and classify sensitive information, establish clear policies for approved AI tools and implement DLP controls across relevant applications and communication channels. Security awareness training should also address practical scenarios employees encounter during their normal responsibilities.
5. Compromised Employee Accounts
Insider risk can also arise when an external attacker gains control of a legitimate user’s account. Consider a portfolio manager who enters their Microsoft 365 credentials into a convincing phishing website. The attacker may subsequently gain access to the employee’s email, SharePoint, OneDrive and Teams resources, depending on the account permissions and existing security controls. From the organisation’s perspective, the malicious activity may appear to originate from an authorised user. This is where insider risk and identity security overlap.
Reducing the risk: Multifactor authentication (MFA), phishing-resistant authentication methods such as passkeys, Conditional Access policies, device compliance requirements and risk-based identity monitoring can help reduce the likelihood and impact of account compromise.
6. Security Processes That Encourage Workarounds
Sometimes the security process itself contributes to the risk. If employees must complete several approval stages to transfer a large document securely, but can send the same information to a personal email account within seconds, some may choose the faster option. The behaviour may violate organisational policy, but it can also indicate that approved processes are too restrictive or difficult to use.
The NCSC (National Cyber Security Centre) has highlighted how security measures that make legitimate work unnecessarily difficult can contribute to non-malicious insider incidents.
Reducing the risk: Security controls should be designed around legitimate working practices. Organisations should identify where employees regularly bypass procedures, understand why those workarounds occur and provide secure alternatives that allow work to be completed efficiently.
Five Warning Signs Your Organisation May Be Exposed to Insider Risk
Insider incidents are not always preceded by obvious suspicious behaviour. In many cases, weaknesses already exist within an organisation’s access management, information-sharing practices and security procedures. The following warning signs may indicate increased exposure.
1. Employees routinely bypass security policies
Employees use unauthorised cloud services, personal email accounts or other prohibited workarounds to complete routine tasks. Repeated exceptions may indicate that security controls are not aligned with everyday working practices.
2. User permissions are rarely reviewed
Employees retain access after completing projects or moving departments, while former employees and contractors continue to hold active accounts. Without regular reviews, unnecessary access can accumulate unnoticed.
3. Sensitive information can be shared without appropriate restrictions
Financial records, investor information, and Confidential documents can be downloaded, forwarded or shared externally without adequate access restrictions, classification or monitoring.
4. Privileged accounts are not adequately controlled
Administrative permissions are widely assigned; shared accounts are used or privileged activity is not consistently logged and reviewed. This can make inappropriate access harder to detect and investigate.
5. Employees are reluctant to report security mistakes
Staff hesitate to report accidentally shared files, suspicious emails or other security incidents because they fear disciplinary consequences. Delayed reporting can allow an otherwise manageable incident to escalate.
These indicators do not necessarily mean an insider incident has occurred. However, they may reveal weaknesses that increase the likelihood or potential impact of one.
Reducing Insider Risk Requires More Than Monitoring Employees
Addressing insider risk does not mean treating every employee as a potential attacker. It means recognising that legitimate access, human behaviour and inadequate processes can combine to create vulnerabilities. Access controls, identity protection, DLP, security awareness training and appropriate monitoring all have a role to play. However, these measures are most effective when supported by clearly defined responsibilities, regular reviews and processes that employees can realistically follow.
Organisations should also make it straightforward for employees to report mistakes, suspicious activity and potential security incidents. An employee who accidentally shares a confidential document should feel able to report the incident immediately, allowing the organisation to investigate and contain any potential exposure. The objective is to create an environment where a single mistake, excessive permission or compromised account is less likely to escalate into a serious security incident.
For financial services firms, this requires a coordinated approach to access management, information protection and operational resilience.
Tivarri works with financial services organisations to strengthen their IT environments through identity and access management, Microsoft 365 security, cybersecurity controls and managed IT support. By addressing weaknesses across systems, permissions and everyday working practices, firms can reduce their exposure to insider risks without unnecessarily restricting legitimate business activity.